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ICO PROSECUTION POLICY STATEMENT 


Introduction 


1. 


The Information Commissioner, as part of her powers to take 
enforcement action under the Information Acts!, has the discretion to 
investigate and prosecute, if appropriate, criminal offences under this 
legislation. The Information Commissioner’s discretion in deciding 
whether to bring a prosecution is delegated by the Commissioner to 
designated lawyer(s) employed by her. Those designated lawyers are 
the decision makers who exercise the delegated authority to prosecute 
independently and on a case by case basis, in accordance with the Code 
for Crown Prosecutors. 


The purpose of this policy is to provide general guidelines that will be 
considered when decisions are made in relation to prosecution or 
alternatives to prosecution, to ensure that such decisions are made in a 
fair and consistent way. 


This document is not exhaustive and each case will be considered 
individually on its merits. In addition to this policy the prosecuting 
lawyer will have regard, where appropriate, to the following: 

e The CPS Code for Crown Prosecutors 

e Code of Practice for Victims 

e The ICO’s Victim Right to Review Policy 

e The ICO’s Regulatory Action Policy 

e The ICO’s Policy on Conviction and Caution Data 

e The CPS Guidelines for Prosecutors on assessing the public interest in 


cases affecting the media, where applicable 


Prosecution 


4. 


The prosecuting lawyer will provide guidance to investigators 
throughout the investigation and prosecution stage, to advise on the 
strength of the evidence and to identify potential deficiencies at an early 
stage. The prosecuting lawyer will do so in a fair, independent and 
objective way. Whilst the prosecuting lawyer will advise on aspects of an 
investigation, the decision whether or not to prosecute is an objective 
and independent exercise, separate to the investigation. 


' Offences are primarily under the Data Protection Act 1998, Data Protection Act 2018 and 
Freedom of Information Act 2000 
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5: In order to summons a suspect with a criminal offence, the 
prosecuting lawyer must be satisfied that there is sufficient evidence to 
provide a realistic prospect of conviction and that a prosecution is in the 
public interest and these factors will be kept under continuous review as 
the prosecution and defence cases develop. 


6. The prosecutor will review and advise on each case which is being 
considered for prosecution in order to assess whether the evidence in 
the case is sufficient to pass the evidential test in the Code for Crown 
Prosecutors. If there is insufficient evidence, consideration will be given 
to whether further evidence can reasonably be obtained. Where this is 
not practicable, no further action will be taken in respect of the criminal 
investigation and the suspect will be advised of this course of action, as 
will the Victim(s) under the ICO’s Victim’s Right to Review Policy. 


7. Where however there is evidence which does not amount to a 
criminal offence but is evidence of non-compliance with the legislation, 
for example a breach of the data protection principles, further 
enforcement action may be taken if considered appropriate. 


8. Where in the opinion of the prosecution lawyer there is sufficient 
evidence they will proceed to consider whether a prosecution would be in 
the public interest, having regard to the public interest test in the Code 
for Crown Prosecutors. No prosecution will proceed unless there is 
sufficient evidence and a prosecution would be in the public interest. The 
prosecuting lawyer may also give consideration to the appropriateness of 
an alternative disposal such as offering a caution (paragraph 15). 


9. Prosecuting Lawyers will prosecute in a fair, independent and 
objective way, not letting any personal views about the ethnic or 
national origin, gender, disability, age, religion or belief, political views, 
sexual orientation, or gender identity of the suspect, victim or any 
witness influence their decisions. 


10. Prosecutors should not be placed under any improper or undue 
pressure by any person within the ICO or any other source. Prosecutors 
must always act in the interests of justice and not solely for the purpose 
of obtaining a conviction. Prosecution decisions made must be informed 
by the principles of proportionality, consistency, transparency and 
accountability. 


11. Where a decision is made to prosecute we will usually notify 
defendants in writing of our intention to do so and may offer them an 
opportunity to make representations to us if appropriate. This will be the 
usual course in cases where we would be unlikely to conduct an 
interview under caution, however, we will proceed to a prosecution 
without asking for representations in cases where, for example, they 
have already had the opportunity to make representations in a PACE 
interview or have refused to be interviewed. 


May 2018 


Proceeds of Crime Act 2002 (POCA) 


12. 


13. 


14. 


In cases concerning the unlawful trade of personal data, 
particularly those which involve substantial amounts of money, the ICO 
will seek to apply provisions under POCA, where appropriate. The ICO 
recognises that where the circumstances of a case would allow 
confiscation to be applied for under POCA, this would be an effective 
deterrent, which can be used to discourage offending committed to 
enrich the offender. 


In cases where the POCA provisions are utilised we will apply them 
proportionately, fairly and within the spirit of the Act. POCA confiscation 
will be considered in all cases which fall within the scope of the Act, 
where offences committed have involved significant sums of money 
including where a series of many smaller transactions amount to a 
substantial sum due to the period of time of trading concerned. 


However, whether to commence POCA proceedings is within the 
Commissioner’s discretion and may not be appropriate or viable in some 
circumstances, for example where there is a victim pursuing a civil 
action or where the defendant is now bankrupt, or where the 
enforcement of an order may not be feasible. 


Cautioning 


15. 


16. 


17. 


A caution may be offered where the accused has made a clear and 
reliable admission of the offence and is prepared to accept a caution, 
providing it is in the public interest to use this means of disposal. If the 
accused has not made admissions, raises a defence or declines the offer 
of a caution then the matter will proceed to prosecution. The implications 
and significance of accepting a caution will be clearly explained to the 
accused at the time a caution is offered and the accused will be allowed 
time to obtain independent legal advice, if required. 


A caution will only be offered where there is a realistic prospect of 
conviction. Where the evidence would be insufficient to proceed to 
prosecution a caution will not be offered and no further action will be 
taken. When an Investigating Officer is of the view that a case is suitable 
for a caution to be offered, this recommendation will be made and advice 
should be sought from the prosecution lawyer. 


The following factors, which are non-exhaustive, may indicate that 
a caution is appropriate as a disposal: 


e offending is low-level in terms of seriousness 

e there are no particular aggravating factors 

e itis a first time offence, particularly if there is a likelihood of a 
caution being effective at securing future compliance 
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e the accused has or is willing to provide assistance to an 
investigation/prosecution 


Consideration will also be given to any mitigating factors, relating to 
either the circumstances of the individual case or the circumstances of 
the accused, which may weigh in favour of a caution rather than a 
prosecution. 


18. The following factors, which are non-exhaustive, weigh in favour of 
a prosecution rather than a caution: 


e The accused is breaching the law for financial gain 

e has abused a position of trust 

e has engaged in a systematic approach to obtaining or attempting 
to obtain personal data 

e there has been damage or distress caused to data subjects 

e the accused has a relevant previous conviction(s) or caution(s) for 
a similar offence or has breached an undertaking. 

e has ignored prior warnings or advice regarding compliance 

e there are grounds for believing the offending will be repeated or 
continued 


Consideration will be given to any aggravating factors in the 
circumstances of the individual case which may make a prosecution in 
the public interest. 


Defendants 


19. Where a prosecution is being considered against a body corporate, 
consideration will be also be given to whether a prosecution is warranted 
against any individuals in a position of responsibility, such as a director 
or manager, where the offence was committed with their consent, 
connivance or attributable to their neglect. Consideration will be given, 
where appropriate, to the role and responsibilities of the individual, the 
management chain and the size and structure of the company. 


20. We will consider whether prosecuting both the body corporate and 
an individual is necessary, for example we may only proceed against one 
of the potential defendants in circumstances where it may be regarded 
as prosecuting the same person twice, e.g. where a sole director is also 
the principle owner of the company. 


21. In a standard partnership, as each partner is jointly and severally 
liable for the acts of the partnership, all partners will normally be 
prosecuted if practicable, unless there is reason to do otherwise, for 
example where the division of responsibilities within the partnership is 
known, in which case discretion may be used to proceed against the 
partner(s) most responsible. 
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Victims 


22. Where there is an identifiable victim, the views of the victim about 
the offence and the proposed method of disposal, as well as details 
regarding any harm or loss will be established where possible. Any such 
views are a factor to be taken into consideration but are not in any way 
conclusive as any decision is within the discretion of the Commissioner. 
The use of Victim Impact statements will be considered for any 
sentencing hearing, however it is considered unlikely that any 
commercial complainant will be called upon to provide a victim impact 
statement. 


23. The ICO is identified as a service provider in the Code of Practice 
for Victims and will have regard to the Code, aiming to treat victims of 
crime in a respectful, sensitive, tailored and professional manner. 
Victims who are not satisfied with a decision of a prosecuting lawyer not 
to prosecute can seek a review of that decision under the ICO’s Victim 
Right to Review policy. 


Scotland 


24. Where an offence occurs in Scotland and it is considered suitable 
for prosecution, the case will be referred to the Procurator Fiscal, who 
will decide whether to bring a prosecution. If so, the Procurator will 
conduct the prosecution with assistance from the Information 
Commissioners Office where required. In Scotland any decisions in 
relation to the proceedings are for the Procurator, although the views of 
the Information Commissioner may be taken into account. 


Costs 


25. We will normally seek to recover the costs of our investigation and 
prosecution at the conclusion of all successful prosecutions. 


Continuing Professional Development 


26. It is the individual duty of prosecuting lawyers employed by the 
ICO to maintain their continued professional development in order to 
ensure that they keep up-to-date with legal developments, particularly 
in relation to prosecutions, and also to ensure that they only undertake 
work which they are qualified and competent to do so. 
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